CMMC Practice SC.L2-3.13.10

Key Management: Establish and manage cryptographic keys for cryptography employed in organizational systems.

Monarch ISC Guidance

Key management is a critical function, since failure to properly manage keys can lead to compromise of systems by malicious entities, or a self-imposed disruption of service that is caused by the loss of encryption keys needed to restore data, in some cases, when systems and data have to be restored from backups. Compliance requires an organization to have a clear plan which identifies the appropriate owners and key period to ensure keys are well-managed.

Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

NIST SP 800-171 R2 Cryptographic key management and establishment can be performed using manual procedures or mechanisms supported by manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, policies, directives, regulations, and standards specifying appropriate options, levels, and parameters. NIST SP 800-56A and NIST SP 800-57-1 provide guidance on cryptographic key management and key establishment.